AN0171
Analytic 0171
Linux
Disabling or modifying the Linux Audit system through process termination (auditd killed), service management (systemctl stop auditd), or tampering with rule/configuration files (/etc/audit/audit.rules, audit.conf). Defender view: suspicious execution of auditctl/systemctl commands, file modifications to audit rules, or sudden absence of audit logs correlated with privileged execution.
auditd:EXECVE
Execution of auditctl, systemctl stop auditd, or kill -9 auditd
auditd:SYSCALL
kill syscalls targeting auditd process
auditd:FILE
Modification or deletion of /etc/audit/audit.rules or /etc/audit/audit.conf
linux:syslog
auditd service stopped or disabled
[ServiceWhitelist]
Exclude legitimate administrative service stops during system maintenance.
[FilePathScope]
Specify monitored paths (/etc/audit/audit.rules, audit.conf) to avoid false positives from unrelated file writes.
[TimeWindow]
Correlate suspicious commands, file modifications, and audit log gaps in short succession.